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DETAILED ACTION 

Claim Rejections - 35 USC §112 

1 . The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

2. Claim 3 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

3. Claim 3 recites the limitation "said code is auto-executable". The specification 
does not define the term "auto-executable". The term was not found in any dictionary. It 
is unclear what this term adds to executable. If a file is executable, it can be executed 
automatically, and is thus auto-executable. For the sake of this office action, the 
examiner understands this claim to mean that the object is automatically removed from 
the envelope when inspection and release is complete. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 1-11, as best understood, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Tso et al., USPN 6,088,803 in view of Hall, USPub 2004/0054928 
A1. 
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With regard to claim 1, Tso discloses a method for preventing activating a 
malicious object passing through a checkpoint (column 2 lines 16-19), and decreasing 
the overall inspection delay thereof (column 3 lines 1 1-14), the method including the 
steps of, creating an envelope file (column 3 lines 14-19) at the checkpoint, being an file 
including the object; and an indicator for indicating the integrity of the object (whether 
the final segment is present, column 3 lines 28-32), and forwarding the envelope file 
instead of the object toward its destination (column 3 lines 39-41), while holding at least 
a part of said envelope file which comprises the indicator (column 3 lines 23-28), 
inspecting the object (column 3 lines 41-44), setting the indicator on the envelope file to 
indicate the inspection result and releasing the rest of the envelope file (column 3 lines 
62-65). In Tso, the envelope file is a copy of the object missing the final segment, and is 
not executable with code that extracts the object. Hall discloses an executable wrapper 
used to protect files (block 0044). Hall teaches that the wrapper protects a file from 
being executed without checking an authorization algorithm by hiding the object, and 
supplementing an executable wrapper that will release the object if authorization is 
checked (blocks 0044-0045). While Tso does not disclose using a wrapper, he does 
disclose that it is desirable to restrict the object from unauthorized use (column 32-38). 
It would have been obvious for one of ordinary skill in the art to secure the object of Tso 
by wrapping it in the wrapper of Hall for the motivation of better safeguarding the 
computer system, a stated motivation of Tso (column 1 lines 28-35), and to prevent 
attacks as taught by Hall (block 0045). 
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With regard to claim 2, Tso discloses the checkpoints as a proxy server (column 
3 lines 20-23). 

With regard to claim 4, Hall discloses the envelope can have the same name as 
the object (both "Is", block 0045). 

With regard to claim 5, Hall discloses the file name is different from that of the 
object (different paths, block 45). 

With regard to claim 6, Tso discloses the indicator is absence of a part of the 
object (column 3 lines 23-28). 

With regard to claims 7 and 8, Tso discloses that part of the envelope file and 
object are held by the checkpoint (column 3 lines 23-28). 

With regard to claim 9, Tso discloses the envelope missing the final bytes of the 
object (column 3 lines 36-38), thus it holds the indicator. 

With regard to claims 3, 10, and 11, Hall teaches that a non-malicious object can 
be immediately executed, and does not need a wrapper (block 0044). Tso teaches that 
once a program has been checked, it can be released (column 3 lines 62-65). It would 
have been obvious for one of ordinary skill in the art to remove the wrapper when it is 
no longer necessary to reduce extra processing time and to maximize efficiency, a 
stated motivation of Tso (column 3 lines 9-14). This would further be a display of the 
integrity of the object (that it no longer is wrapped). 

Response to Arguments 
6. Applicant's arguments filed 22 January 2007 have been fully considered but they 
are not persuasive. 
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Applicant argues limitations from the specification. While the claims are read in 
light of the specification, limitations from the specification are not read into the claim in 
order to allow applicant to claim his invention broadly. If applicant wants limitations from 
the specification describing aspects of the file wrapper to be considered, he should 
include them in the claim. 

Applicant refers to cited portions of the art. The examiner does not cite any 
portions of prior art. The claims are rejected over the entire art. Columns and line 
numbers included in parenthesis are to help give applicant a general idea of what 
aspects of the art correspond to the claims. 

With regard to applicant's argument that Tso does not retain an indicator the 
examiner points to the retained file portion (column 3 lines 23-32), which indicates if 
virus checking has occurred and if complete transmission was authorized. 

With regard to applicant's argument that the publication of Hall is missing figures 
and thus is ambiguous, the examiner disagrees. Hall clearly describes the wrapper, and 
the figures are not necessary for one of ordinary skill in the art to understand Hall. Hall 
discloses wrapping an executable so an attacker would not know the location of the 
actual executable code. 

With regard to applicant's argument that there is no motivation to combine Hall 
and Tso, the examiner again states that the motivation is to better safeguard the 
computer system against different types of attack. Applicant admits that Hall and Tso 
are safeguarding against different types of attack. It is well known in the art, and highly 
desirable to protect against multiple types of attack. 
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With regard to applicant's argument that auto-executable is a well known term 
and is defined in paragraph 12 of the specification, the examiner points out that the 
specification merely uses the same term without defining it or describing it's meaning in 
any way. The examiner stated that it would be understood as meaning just executable, 
and applicant suggested that this proves that the term is clear. If the term means 
nothing more than "executable", it should say only "executable" and not "auto- 
executable", which the examiner could not find in any dictionary. 

Conclusion 

7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jacob Lipman whose telephone number is 571-272- 
3837. The examiner can normally be reached on M-Fr. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on 571-272-381 1. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 




